Before you begin
- The Microsoft 365 inventory permission (m365.inventory.view) for Overview, Exchange Online, OneDrive, SharePoint, Teams and Intune. Admin, Operator, Security Admin, Auditor, Help Desk and Read Only have it
- The Microsoft 365 licensing permission (m365.license.view) for the Licensing page. Admin, Operator, Security Admin and Auditor have it; assigning and removing licenses needs m365.license.assign (Admin, Operator and Security Admin)
- The Atlas app registration in the tenant must hold the Microsoft permissions listed under Required Microsoft permissions below. The standard setup script grants them
A read-only view of the selected tenant
Every page in the section shows the tenant chosen in the tenant selector, and only that tenant. Switch tenants and the pages follow. Atlas reads the data through its own app registration, keeps it for about five minutes, and never changes a mailbox, site or device from these pages. A Read-only badge marks each inventory page.
The section holds Overview, Exchange Online, OneDrive, SharePoint, Teams, Intune, Purview, Defender and Licensing. Purview and Defender have their own permissions (m365.purview.view and m365.defender.view, held by Admin, Operator, Security Admin and Auditor), because their data is compliance- and security-sensitive. This guide covers the inventory pages and Licensing.
Every module except Licensing can be hidden for a tenant. They are on by default; turn one off on the Preview step of first-run setup to remove that row from the sidebar.
Exchange Online
Exchange Online lists the tenant's recipients: user, shared, room and equipment mailboxes, distribution groups and mail-enabled security groups. Search by name, address or UPN, or narrow the list with the Resource type filter. Each row shows the primary SMTP address, user principal name, account status and license.
Click a recipient to open the Recipient details drawer, with its aliases, licenses and the source the details came from.
Mailbox types come from Exchange Online, not Microsoft Graph. Until Atlas can read Exchange Online, mailboxes are listed as "Mailbox (type unavailable)"; distribution and mail-enabled security groups keep their type either way.
OneDrive and SharePoint
OneDrive lists every user's OneDrive with its provisioning status, storage used against its quota, and last activity, with totals for sites and storage across the top. SharePoint does the same for SharePoint sites: storage, last activity and active sites. Both pages are built from Microsoft's 30-day usage reports, which Microsoft refreshes about once a day.
If your tenant hides names in its usage reports, OneDrive shows "Owner concealed" and SharePoint shows a "Site names are hidden" notice, with dashes in place of names. Storage and activity figures are still accurate. You can turn the setting off from the notice: Show real site names opens the Show concealed names? confirmation. The change is tenant-wide, needs the SharePoint management permission (m365.sharepoint.manage) and is recorded in the audit log. See Show Real Names in Microsoft 365 Reports for the full walkthrough.
Intune
Intune shows the devices the tenant manages through Microsoft Intune. Cards across the top count managed, compliant, non-compliant and inactive devices (no check-in for a set number of days). The page has four tabs:
- Devices: the searchable device inventory, filterable by compliance, platform and ownership, with each device's OS, management channel, enrollment, primary user, serial number and last sync. Click a device for its read-only details
- Compliance: the tenant's compliance policies, with platform and assignment count
- Configuration: configuration profiles, with platform and assignment count
- Apps: managed apps, with publisher, type, platform and publishing state
Policies & apps sums up the compliance policies, configuration profiles and managed apps, and Platform breakdown splits your devices across Windows, macOS, iOS/iPadOS and Android.
Licensing
Open Microsoft 365 → Licensing (Microsoft 365 Licensing) to see the tenant's licenses. Unlike the inventory pages, this one is not a preview and is not read-only.
- Subscribed Licenses: every license the tenant subscribes to, with total, assigned and available seats, paid and trial seats, and an estimated monthly cost. Search the list, or export it as CSV, Excel or PDF; the PDF is the Microsoft 365 Licensing Report
- Cost estimates: Estimated Monthly Cost and Estimated Annual Cost, plus a chart of the top license types by cost. They use paid seats and Microsoft's published list prices in US dollars. Free-trial seats and licenses with no published price are left out, and your actual bill varies with purchase channel, discounts, currency and region
- Unlocked Features: every service your licenses include, and which license grants each one
- License details: click a license to see what it unlocks, its estimated retail cost and who has it
Assign or remove a license
- Open Microsoft 365 → Licensing and click the license.
- Under Assign this license to a user, search for the user and add them. Atlas checks the user first: if they already have the license, if none are available, or if they have no usage location set, it tells you instead of assigning. Set a missing usage location in the Microsoft 365 admin center, then try again.
- To take a license away, click Remove next to the user under Assigned users and confirm in the Remove license? dialog.
Assigning a license can add to your Microsoft bill, and removing one takes away the user's access to every service it includes straight away. Both need the m365.license.assign permission.
Required Microsoft permissions
Each page reads under these permissions on the Atlas app registration. The standard setup script grants them all. Where Atlas needs to write as well as read, setup grants only the ReadWrite permission, which includes read access, so you won't see a separate Read permission for it in the Azure portal. Reports.Read.All, SharePointTenantSettings.Read.All and the Exchange Administrator role are optional, and only the pages that use them are affected without them.
- Microsoft Graph: User.Read.All, Group.ReadWrite.All, Directory.Read.All, Domain.Read.All and Organization.Read.All, for the Overview, recipients and licenses
- Reports.Read.All, for OneDrive and SharePoint usage
- SharePointTenantSettings.Read.All, for the tenant policies (sharing, sync, storage) on the SharePoint and OneDrive pages
- Exchange.ManageAsApp plus the Exchange Administrator role on the Atlas service principal, for mailbox types. Without them, mailboxes are listed without a type
- Intune: DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All and DeviceManagementApps.ReadWrite.All
When a grant is missing, the page shows everything else it could read, shows a dash rather than a zero for the missing figures, and displays an amber "Additional permissions required" notice naming the permission to add. To grant it, see Recreate App Registration API Permissions.